update to include a simple user profile and ref from security rules